Description
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
Remediation
References
Related Vulnerabilities
PHP Improper Restriction of XML External Entity Reference Vulnerability (CVE-2013-1824)
Drupal Core 6.x Multiple Vulnerabilities (6.0 - 6.31)
XOOPS CVE-2009-3963 Vulnerability (CVE-2009-3963)
Joomla Permissions, Privileges, and Access Controls Vulnerability (CVE-2006-4476)
WordPress Plugin Event Calendar WD-Responsive Event Calendar Cross-Site Scripting (1.1.44)